Lin Ma e305509e67 Bluetooth: use correct lock to prevent UAF of hdev object ...

The hci_sock_dev_event() function will cleanup the hdev object for
sockets even if this object may still be in used within the
hci_sock_bound_ioctl() function, result in UAF vulnerability.

This patch replace the BH context lock to serialize these affairs
and prevent the race condition.

Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

2021-05-31 14:33:26 +02:00

45 KiB

Raw Blame History

View Raw